I would argue that if the players want to exploit the human element of my NPCs, they need to interact with the NPCs. If someone has redundant passwords, then they need to find a weaker device and grab the password from it. If there's a chance they can get the person to give them access via some means - well that's even better.
Even though the rules state otherwise, I think it's better for roleplaying, better for mechanics, and better for bookkeeping if the Willpower is taken out of the unmanned devices equation.